Section 508 requires federal agencies to buy accessible technology, so it reaches you as a request for an Accessibility Conformance Report (ACR) showing how your product meets the Revised 508 Standards, which incorporate WCAG 2.0 Level A and AA. Section508.gov tells vendors to write it on the VPAT’s Section 508 or INT edition. Checked on .
Key Takeaway
Federal buyers do not ask whether your product is accessible. They ask for the document that shows how you know: an ACR, with a description of how the product was tested. Section508.gov tells agencies to require that description, and to reserve the right to test the product themselves.
Where the Requirement Comes From
Section 508 of the Rehabilitation Act requires federal agencies to make their information and communications technology accessible to people with disabilities. That covers what agencies build, and it covers what they buy. When an agency procures software, it has to weigh accessibility in the purchase, which is why accessibility documentation shows up in federal RFPs, RFQs, and vendor questionnaires. Section508.gov’s own ACR and VPAT FAQ is blunt about the vendor’s side: using the VPAT template isn’t required, but completing an ACR isn’t voluntary if you want the government to consider your product.
The Revised Section 508 Standards incorporate WCAG 2.0 (Web Content Accessibility Guidelines) Level A and AA by reference, and apply them to software and electronic content as well as web pages. The document agencies expect is an ACR, and section508.gov’s guide to creating one tells vendors selling to the federal government to use the VPAT’s Revised Section 508 or INT edition. The INT edition also carries the WCAG 2.2 tables, and which edition you need depends on who else might ask. If those acronyms are new, start here.
What the Reviewer Actually Reads
The person evaluating your submission is rarely the end user. They are a procurement or 508 program office reviewer comparing conformance reports across vendors. Three things separate a submission that survives that reading from one that does not:
- Who performed the evaluation. A named evaluator with a checkable credential reads very differently from an unnamed “internal team.”
- How it was tested. Manual testing with a keyboard and a screen reader, stated plainly, versus an automated scan repackaged as an evaluation.
- Whether the remarks say anything. A row that reads “Partially Supports” with the specific failing component named is credible. A column of bare “Supports” entries with empty remarks is a red flag reviewers know well.
Why the Trusted Tester Methodology Matters
Trusted Tester is the Department of Homeland Security’s manual test process for checking web content against Section 508. Its point is consistency. DHS says it provides consistent testing methods and reporting, and section508.gov describes it as aligned with the ICT Testing Baseline and producing repeatable, reliable results, which is what lets agencies compare the reports they receive.
Agencies that adopt the Trusted Tester process accept test results only from individuals certified as Trusted Testers. Adoption is each agency’s own decision, not a rule across the government. If a federal buyer is in your pipeline, ask the contracting officer whether that agency uses it, and read the solicitation for who is expected to do the testing. The certification is for the tester, not the product, and is there a Section 508 certification explains why no product can be “508 certified.”
For a vendor, that means an ACR produced under the Trusted Tester methodology speaks the reviewer’s own language. Harbor is led by Andrew Szigety, DHS Trusted Tester for Web (TT-2606-09221, the certificate is published on this site). Every Harbor ACR is signed by a named DHS Trusted Tester, and we have published a full worked evaluation of a federal homepage run through this exact process, including every automated finding that manual verification threw out.
How Vendors Disqualify Themselves
| Mistake | How the Reviewer Reads It |
|---|---|
| No evaluation methods described | Section508.gov tells agencies to require a description of the methods behind the ACR. A report that never says how the product was tested gives the reviewer nothing to check. |
| Automated-scan-only report | A scanner can decide about six of the 55 criteria on its own. The reviewer knows the rest went untested. |
| Wrong edition | A WCAG-only ACR answers a question the agency did not ask. Federal work wants the Section 508 or INT edition. |
| Stale report | An ACR covering a version you no longer ship documents a product the agency cannot buy. |
| All “Supports,” no remarks | Real products have findings. A spotless report with empty remarks reads as unexamined, not conforming. |
“Partially Supports” Is Not a Failing Grade
Some vendors hold off on an ACR until the product is clean. That gets the document backwards. The ACR reports current state, and section508.gov’s own FAQ says a product that doesn’t meet every Section 508 standard is still considered for purchase and compared against similar products. What stalls the deal is having nothing credible to send, not having findings.
45
Days to a signed, procurement-ready ACR, committed at signing
What to Do Next
If a federal or state opportunity is on your calendar, work backwards from its dates. Harbor delivers a signed VPAT/ACR on day 14 of a Standard engagement, day 21 on Professional, with the date committed at signing. If the solicitation cannot wait that long, say so on the first call. For a federal buyer the evaluation is performed under the DHS Trusted Tester methodology by a certified Trusted Tester, and you can read a full sample deliverable before you spend anything.
- Section 508 Testing
- A Worked 508 Evaluation
- Who Actually Publishes an ACR
- View a Sample Report
- How Engagements Work
Common Questions
- What does Section 508 require from software vendors?
- Section 508 requires federal agencies to buy accessible technology, so vendors are asked for an Accessibility Conformance Report (ACR) showing how the product meets the Revised 508 Standards, which incorporate WCAG 2.0 Level A and AA. Section508.gov tells agencies to require an ACR and a description of the evaluation methods behind it for each off-the-shelf product.
- Do I need a VPAT to sell software to the federal government?
- You need an ACR, and the VPAT is the most common way to write one. Section508.gov says using the VPAT itself is not required, but completing an ACR is not voluntary if you want the government to consider buying your product. Use the Revised Section 508 or INT edition of the template.
- Which WCAG version does Section 508 require?
- WCAG 2.0 Level A and AA. The Revised 508 Standards incorporate it by reference and apply it to software and electronic content as well as web pages. The VPAT’s Section 508 edition reports against it, and the INT edition adds the WCAG 2.2 tables for buyers who also ask about the newer version.
- Do you need DHS Trusted Tester certification to sell to federal agencies?
- Not across the government. Agencies that adopt the DHS Trusted Tester process accept test results only from certified Trusted Testers, and adoption is each agency’s own decision. Ask the contracting officer whether the agency you are selling to uses it, and read the solicitation for who is expected to do the testing.
- Will a federal agency buy a product that only partially supports Section 508?
- It can. Section508.gov’s FAQ says a product that does not meet every Section 508 standard is still considered for purchase and compared with similar products. Mark Partially Supports honestly and explain the gap in the remarks, which section508.gov says are required on any row marked Partially Supports or Does Not Support.